Article written by Brian Gordon, former Big Four Audit Partner and Executive Board Leader
Having spent decades advising financial institutions, I’ve seen bank boards and audit committees work tirelessly to fulfill their oversight responsibilities. Yet too often, even well‑intentioned boards miss key warning signs until they become costly problems. The issue isn’t a lack of commitment; it’s the persistence of certain blind spots that cloud judgment, distort priorities, and delay action.
Below are the five most common gaps I observed during my time as an audit partner, and what boards can do differently before those gaps turn into crises.
The 5 Most Common Audit Gaps That Boards Miss
1. Underestimating the Importance of the Right People and Infrastructure
One of the most persistent blind spots I saw was the failure to ensure that an organization had the right people in the right roles, especially during periods of start‑up or rapid growth. Many boards assume that if business performance looks strong, the underlying infrastructure must be keeping pace. In reality, underinvestment in critical functions, including finance, risk management, and compliance, often creates a slow‑burning vulnerability.
- The Fix: Periodically evaluate whether staffing levels, skill sets, and reporting lines still align with the business’s scale and complexity. Growth without infrastructure is not sustainable growth.
2. Overreliance on Forward‑Looking Assumptions
In banking, timely and accurate credit‑risk monitoring is fundamental. But I’ve seen loan officers, credit teams, and risk oversight functions collectively underestimate risk by placing too much faith in future projections rather than current facts. Optimism can be a dangerous bias when tied to lending decisions.
- The Fix: Require management to ground their assessments in present‑day evidence. Risk oversight should include a disciplined “effective challenge” process that forces decision‑makers to reconcile forecasts with verifiable data. Facts, not expectations, should anchor risk evaluation.
3. Treating Audit Committee Meetings as Report Reviews, Not Risk Dialogues
The strongest audit committees I worked with approached meetings as discussions rather than briefings. Their agendas focused on concise executive summaries from management, internal audit, and the external auditor, allowing members to devote more time to what matters most. Pre‑meeting sessions between the Audit Committee Chair and each party (including the auditor) proved particularly valuable, surfacing key themes before formal meetings began.
- The Fix: Design audit committee meetings around dialogue and prioritization, not document review. Build in time for executive sessions, deep‑dive discussions, and manage the agenda with intent.
4. Confusing Control Deficiencies with Misstatements
Another frequent misunderstanding arises when boards and management teams conflate a control deficiency with a financial misstatement. A misstatement might reveal a control issue, but the absence of misstatements doesn’t prove the controls are sound. Unaddressed deficiencies can resurface later with far greater impact.
- The Fix: Evaluate each control deficiency on its own merits, focusing on root cause, potential magnitude, and the adequacy of compensating controls. Every deficiency deserves attention, even if financial reporting hasn’t yet reflected a loss.
5. Failing to Adapt Oversight as the Regulatory Landscape Changes
Over the past decade, evolving regulations, such as CECL and new capital adequacy standards, have dramatically increased both the complexity and the frequency of risk oversight discussions. In periods of regulatory change, I’ve seen communication either intensify productivity or deteriorate into confusion.
- The Fix: When technical or complex changes arise, ensure every stakeholder, from management to the board, develops a shared understanding of the success factors, priorities, and key risks in plain terms. Open, frequent communication is your best defense against misunderstanding and ineffective oversight.
3 Things That Boards Can Do Moving Forward:
1. Ask These Questions Quarterly
If I were advising a mid‑sized bank board today, I’d start with three non‑negotiable questions every quarter:
- Have reconciliation controls for all balance sheet accounts been completed, with reconciling items addressed?
- Have all control owners certified that their controls operated effectively as designed?
- For each control deficiency identified, has the root cause been determined and remediation implemented?
These questions are simple, but they surface whether the control environment is functioning as intended.
2. Use External Auditors Strategically
Audit committees sometimes overlook a valuable resource: the auditor’s perspective. External auditors see numerous organizations across the industry, allowing them to identify emerging risks and effective practices. Boards should invite those insights while maintaining independence and confidentiality. When used properly, an auditor’s field of vision can be a powerful complement to management’s perspective.
3. And Finally: Advice For New Audit Committee Members
For newcomers, the first 90 days are crucial. Spend that time understanding the organization’s operating foundation, meeting with management to learn how responsibilities and reporting lines connect, and identifying the company’s most significant objectives and risks. Most importantly, ask questions early, both to clarify and to build credibility. The fastest way to get up the learning curve is to be curious.
Boards and audit committees play an essential role in maintaining trust and stability in banking. The best ones don’t eliminate risk. They recognize it early, address it swiftly, and strengthen governance before a crisis can take root.
